Local LPE via insecure perms in Lenovo App Store (Legion Zone) on Windows
CVE-2026-9046 Published on July 16, 2026

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a nonsystem partition, could allow a local user to execute arbitrary code.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-9046 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Insecure Inherited Permissions

A product defines a set of insecure permissions that are inherited by objects that are created by the program.


Products Associated with CVE-2026-9046

stack.watch emails you whenever new vulnerabilities are published in Lenovo Legion Zone or Lenovo App Store. Just hit a watch button to start following.

Lenovo Legion Zone
 
Lenovo App Store
 

Affected Versions

Lenovo Legion Zone: Lenovo App Store: